SSH-CERTD(8)                   SSH2                  SSH-CERTD(8)


NAME
       ssh-certd  - Secure Shell Certificate Validator on z/OS


SYNOPSIS
       ssh-certd [-d debug_level_spec] [-f config_file]
       [-o options] [-l listener-path] [-F] [-v] [-V] [-q]


DESCRIPTION
       ssh-certd (Secure Shell Certificate Validator) is a common
       process  for  validating  certificates,  used primarily by
       sshd2 when validating user certificates. Without a  common
       place  for  the  validations,  all the data needed for the
       validation would need to be duplicated  in  every  process
       doing  the  validations.  This  would  be very inefficient
       especially in cases where very large CRLs are to be  used.
       ssh-certd  allows  CRLs  and  CA certificates to be loaded
       only once and then used for all subsequent validations.

       ssh-certd  is  normally  started   at   boot   time   from
       /etc/rc.local or equivalent. It opens a listener socket by
       default   at  /opt/tectia/var/run/ssh-certd-listener.  The
       location  of  the  listener  can   be  changed   with  the
       CertdListenerPath keyword of sshd2_config.

       ssh-certd  can be configured using command-line options or
       a configuration file.  Command-line options override  val-
       ues  specified in the configuration file.  ssh-certd reads
       configuration data  from  /opt/tectia/etc/ssh_certd_config
       (or the file  specified  with -f on the command line).  By
       default, the configuration file contains only the  keyword
       UseSSHD2ConfigFile,  which instructs ssh-certd to read the
       specified sshd2 configuration file in compatibility  mode,
       where  the  configuration  options  of  sshd2 are silently
       ignored, and only the options relating to  certificate  or
       general daemon configuration are read.



OPTIONS
       -d debug_level_spec
              Debug  mode.  The server sends verbose debug output
              to stderr. This option is only intended for  debug-
              ging for the server.  The debugging level is either
              a number, or a comma-separated list of  assignments
              of  the format ModulePattern=debug_level, for exam-
              ple "*=10,sshd2=2".  This should be the first argu-
              ment on the command line.

       -f configuration_file
              Specifies  the name of the configuration file.  The
              default is  /opt/tectia/etc/ssh_certd_config.  Note:
              If this   is   specified, the  default configuration
              file is not read at all.

       -o 'option'
              Can be used to give options in the format  used  in
              the configuration files.  This is useful for speci-
              fying options for which there is no  separate  com-
              mand-line  flag.  The option has the same format as
              a line in the configuration  file.   Comment  lines
              are  not  accepted.   Where applicable, egrep regex
              format is used.

       -l listener-path
              Specifies the path where the server will  open  the
              listener socket.

       -F     Disables  daemon mode.  The server does not spawn a
              new process to the background.

       -v     Enables verbose mode.  Displays  verbose  debugging
              messages.   Equal to -d 2.  This option can also be
              specified in the configuration file.

       -V     Displays version string.

       -q     Quiet mode.  Nothing is sent  to  the  system  log.
              Normally  the beginning, authentication, and termi-
              nation of each connection is logged.   This  option
              can also be specified in the configuration file.


CONFIGURATION FILE
       ssh-certd      reads      configuration      data     from
       /opt/tectia/etc/ssh_certd_config (or the file specified with -f
       on  the  command  line).   The file contains keyword-value
       pairs, one per line.  Lines starting with  '#'  and  empty
       lines are interpreted as comments.

       For  the  format  of  ssh_certd_config, see ssh_certd_con-
       fig(5).


FILES
       /opt/tectia/etc/ssh_certd_config
              Contains configuration data  for  ssh-certd.   This
              file  should  be  writable  by root only, but it is
              recommended  (though  not  necessary)  that  it  be
              world-readable.   For  ease of migration from older
              installations, ssh_certd_config contains by default
              the  line  "UseSSHD2ConfigFile sshd2_config", which
              instructs ssh-certd to read the certificate config-
              uration  from  the  sshd2  configuration  file  and
              ignore the options that are not relevant to it.


INSTALLATION
       ssh-certd is normally run as root.


AUTHORS
       Tectia Corporation

       For more information, see http://www.tectia.com.


SEE ALSO
       ssh_certd_config(5), sshd2(8)